CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
CVE-2015-1000003 affects the filedownload plugin version 1.4 for WordPress, which is vulnerable to Blind SQL Injection. An attacker can exploit this vulnerability to execute unauthorized database queries.
The fast-image-adder plugin version 1.1 for WordPress has a vulnerability that allows remote file uploads.
The vulnerability allows remote file uploads in the mailcwp plugin version 1.99 for WordPress.
Buffer overflow in the Overlay Transport Virtualization (OTV) GRE feature in Cisco NX-OS 5.0 through 7.3 on Nexus 7000 and 7700 devices allows remote attackers to execute arbitrary code via long parameters in a packet header.
The rsyncd server in Fortinet FortiWLC versions 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 has a hardcoded rsync account, allowing remote attackers to read or write to arbitrary files via unspecified vectors.
The SCTC_REFRESH_EXPORT_TAB_COMP, SCTC_REFRESH_CHECK_ENV, and SCTC_TMS_MAINTAIN_ALOG functions in the SCTC subpackage in SAP Netweaver 7.40 SP 12 allow remote authenticated users with certain permissions to execute arbitrary commands via a CALL 'SYSTEM' statement.
CVE-2016-7161 involves a heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU, allowing attackers to execute arbitrary code on the QEMU host via a large ethlite packet.
F5 BIG-IP LTM systems in versions 11.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF11, 11.5.0, 11.5.1 before HF11, 11.5.2, 11.5.3, 11.5.4 before HF2, 11.6.0 before HF8, 11.6.1 before HF1, 12.0.0 before HF4, and 12.1.0 before HF2 allow remote attackers to modify or extract system configuration files via vectors involving NAT64.
Johnson & Johnson Animas OneTouch Ping devices mishandle acknowledgements, which makes it easier for remote attackers to bypass authentication via a custom communication protocol.
Johnson & Johnson Animas OneTouch Ping devices allow remote attackers to bypass authentication via replay attacks.
Beckhoff Embedded PC images before October 22, 2014, and ADS TwinCAT components may allow remote attackers to gain access via the Windows CE Remote Configuration Tool, CE Remote Display service, or TELNET service.
Beckhoff Embedded PC images before October 22, 2014, and ADS TwinCAT components do not restrict the number of authentication attempts, making it easier for remote attackers to gain access via a brute-force attack.
The vApp Managers web application in EMC Unisphere for VMAX Virtual Appliance 8.x before 8.3.0 and Solutions Enabler Virtual Appliance 8.x before 8.3.0 allows remote attackers to execute arbitrary code via crafted input to the (1) GetSymmCmdRequest or (2) RemoteServiceHandler class.
The client in EMC Replication Manager (RM) before version 5.5.3.0_01-PatchHotfix, EMC Network Module for Microsoft 3.x, and EMC Networker Module for Microsoft 8.2.x before version 8.2.3.6 allows remote RM servers to execute arbitrary commands by placing a crafted script in an SMB share.
Buffer overflow in the PPPoE module in Huawei USG2100, USG2200, USG5100, and USG5500 unified security gateways with software before V300R001C10SPC600, when CHAP authentication is configured on the server, allows remote attackers to cause a denial of service (server restart) or execute arbitrary code via crafted packets sent during authentication.
An XXE vulnerability in the SqlXmlUtil code in Apache Derby before version 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service via vectors involving XmlVTI and the XML datatype.
The qstr method in the PDO driver in the ADOdb Library for PHP before version 5.20.7 may allow remote attackers to conduct SQL injection attacks due to incorrect quoting.
CoreResponseStateManager in Apache MyFaces Trinidad versions 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 may allow attackers to conduct deserialization attacks via a crafted serialized view state string.
A stack-based buffer overflow in the extractTree function in unADF allows remote attackers to execute arbitrary code via a long pathname.
Virtual servers in F5 BIG-IP systems in versions 11.5.0, 11.5.1 before HF11, 11.5.2, 11.5.3, 11.5.4 before HF2, 11.6.0 before HF8, 11.6.1 before HF1, 12.0.0 before HF4, and 12.1.0 before HF2, when configured with HTTP Explicit Proxy functionality or SOCKS profile, allow remote attackers to modify system configuration, read system files, and possibly execute arbitrary code via unspecified vectors.